CVE-2022-45048

Apache Ranger: code execution vulnerability in policy expressions

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

CVSS 3.1 · 8.4 High EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Ranger

CVE-2022-42920

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed

Vendors

Apache Fedoraproject Redhat

Products

Commons Bcel Fedora Amq Streams and 7 more

CVE-2022-42890

Apache Batik prior to 1.16 allows RCE via scripting

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Batik Debian Linux Camel Spring Boot and 1 more

CVE-2022-42889

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Not listed

Vendors

Apache Juniper Netapp and 1 more

Products

Commons Text Jsa1500 Jsa3500 and 18 more

CVE-2022-42467

h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.

When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as "webAdminPass: xxx" (where "xxx") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mode.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Apache

Products

Isis

CVE-2022-42009

Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

CVSS 3.1 · 8 High EPSS 1.2% KEV · Not listed

Vendors

Apache

Products

Ambari

CVE-2022-41672

Session still functional after user is deactivated

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

CVSS 3.1 · 8.1 High EPSS 1.5% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2022-40705

Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Apache

Products

Soap

CVE-2022-40160

Stack Overflow in JXPath

** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Commons Jxpath

CVE-2022-40159

Stack Overflow in JXPath

** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Commons Jxpath

CVE-2022-39337

Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat

Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Hertzbeat

CVE-2022-39135

Apache Calcite: potential XEE attacks

Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Apache

Products

Calcite

CVE-2022-38370

No authorization of DatabaseConnectController in grafana-connector.

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Iotdb

CVE-2022-38369

Login check vulnerability by session Id

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apache

Products

Iotdb

CVE-2022-38362

Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Apache

Products

Apache-airflow-providers-docker

CVE-2022-38170

Overly permissive umask for daemons

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2022-38054

Session Fixation

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2022-37435

Apache ShenYu Admin Improper Privilege Management

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apache

Products

Shenyu

CVE-2022-37401

Apache OpenOffice Weak Master Keys

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Apache

Products

Openoffice

CVE-2022-37400

Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Openoffice